librex 0.0.4 → 0.0.5

data/lib/rex/proto/smb/constants.rb

@@ -110,6 +110,8 @@ NT_TRANSACT_SET_SECURITY_DESC        = 3 # Set security descriptor
 NT_TRANSACT_NOTIFY_CHANGE            = 4 # Start directory watch
 NT_TRANSACT_RENAME                   = 5 # Reserved (Handle-based)
 NT_TRANSACT_QUERY_SECURITY_DESC      = 6 # Retrieve security
+NT_TRANSACT_GET_USER_QUOTA           = 7 # Get quota
+NT_TRANSACT_SET_USER_QUOTA           = 8 # Set quota
 
 # Open Modes
 OPEN_MODE_CREAT = 0x10   # Create the file if file does not exists. Otherwise, operation fails.
@@ -468,9 +470,9 @@ SMB_NEG_RES_NT_HDR_PKT = Rex::Struct2::CStructTemplate.new(
 	[ 'uint32v', 'MaxRaw',               0 ],
 	[ 'uint32v', 'SessionKey',           0 ],
 	[ 'uint32v', 'Capabilities',         0 ],
-	[ 'uint32v', 'ServerTime',           0 ],
-	[ 'uint32v', 'ServerDate',           0 ],
-	[ 'uint16v', 'Timezone',             0 ],
+	[ 'uint32v', 'SystemTimeLow',        0 ],
+	[ 'uint32v', 'SystemTimeHigh',       0 ],
+	[ 'uint16v', 'ServerTimeZone',       0 ],
 	[ 'uint8',   'KeyLength',            0 ],
 	[ 'uint16v', 'ByteCount',            0 ],
 	[ 'string',  'Payload', nil,        '' ]

data/lib/rex/proto/smb/utils.rb

@@ -54,6 +54,8 @@ CONST = Rex::Proto::SMB::Constants
 		return CONST::CREATE_ACCESS_OPENCREATE
 	end
 
+	# NOTE: the difference below came from: Time.utc("1970-1-1") - Time.utc("1601-1-1")
+
 	# Convert a 64-bit signed SMB time to a unix timestamp
 	def self.time_smb_to_unix(thi, tlo)
 		(((thi << 32) + tlo) / 10000000) - 11644473600

data/lib/rex/proto/tftp.rb

@@ -1,3 +1,12 @@
-# $Id: tftp.rb 9333 2010-05-21 00:03:04Z jduck $
+# $Id: tftp.rb 9962 2010-08-06 17:21:22Z jduck $
+#
+# TFTP Server implementation according to:
+#
+# RFC1350, RFC2347, RFC2348, RFC2349
+#
+# written by jduck <jduck [at] metasploit.com>
+# thx to scriptjunkie for pointing out option extensions
+#
+
 require 'rex/proto/tftp/constants'
 require 'rex/proto/tftp/server'

data/lib/rex/proto/tftp/constants.rb

@@ -1,4 +1,4 @@
-# $Id: constants.rb 9334 2010-05-21 00:15:10Z jduck $
+# $Id: constants.rb 9962 2010-08-06 17:21:22Z jduck $
 require 'rex/proto/tftp'
 
 module Rex
@@ -11,7 +11,7 @@ OpWrite = 2
 OpData = 3
 OpAck = 4
 OpError = 5
-
+OpOptAck = 6
 
 ERRCODES = [
 	"Undefined",
@@ -21,7 +21,8 @@ ERRCODES = [
 	"Illegal TFTP operation",
 	"Unknown transfer ID",
 	"File already exists",
-	"No such user"
+	"No such user",
+	"Failed option negotiation"
 ]
 
 ErrFileNotFound = 1
@@ -31,6 +32,7 @@ ErrIllegalOperation = 4
 ErrUnknownTransferId = 5
 ErrFileExists = 6
 ErrNoSuchUser = 7
+ErrFailedOptNegotiation = 8
 
 end
 end

data/lib/rex/proto/tftp/server.rb

@@ -1,4 +1,4 @@
-# $Id: server.rb 9742 2010-07-08 23:34:29Z jduck $
+# $Id: server.rb 10163 2010-08-27 04:44:02Z jduck $
 require 'rex/socket'
 require 'rex/proto/tftp'
 
@@ -10,7 +10,9 @@ module TFTP
 # Little util function
 #
 def self.get_string(data)
-	ret = data.slice!(0,data.index("\x00"))
+	idx = data.index("\x00")
+	return nil if not idx
+	ret = data.slice!(0, idx)
 	# Slice off the nul byte.
 	data.slice!(0,1)
 	ret
@@ -71,7 +73,7 @@ class Server
 
 		self.files.clear
 		self.thread.kill
-		self.sock.close
+		self.sock.close rescue nil # might be closed already
 	end
 
 
@@ -200,7 +202,7 @@ protected
 
 	def check_retransmission(tr)
 		elapsed = Time.now - tr[:last_sent]
-		if (elapsed >= 3)
+		if (elapsed >= tr[:timeout])
 			# max retries reached?
 			if (tr[:retries] < 3)
 				#if (tr[:type] == OpRead)
@@ -254,7 +256,7 @@ protected
 						check_retransmission(tr)
 					elsif (w != nil and w[0] == self.sock)
 						# No ack waiting, send next block..
-						chunk = tr[:file][:data].slice(tr[:offset], 512)
+						chunk = tr[:file][:data].slice(tr[:offset], tr[:blksize])
 						if (chunk and chunk.length >= 0)
 							pkt = [OpData, tr[:block]].pack('nn')
 							pkt << chunk
@@ -283,7 +285,7 @@ protected
 						tr[:last_sent] = Time.now
 
 						# If we had a 0-511 byte chunk, we're done.
-						if (tr[:last_size] and tr[:last_size] < 512)
+						if (tr[:last_size] and tr[:last_size] < tr[:blksize])
 							#puts "[*] Transfer complete, saving output"
 							save_output(tr)
 							self.transfers.delete(tr)
@@ -325,15 +327,21 @@ protected
 				if (file[:once] and file[:started])
 					send_error(from, ErrFileNotFound)
 				else
-					self.transfers << {
+					transfer = {
 						:type => OpRead,
 						:from => from,
 						:file => file,
 						:block => 1,
+						:blksize => 512,
 						:offset => 0,
+						:timeout => 3,
 						:last_sent => nil,
 						:retries => 0
 					}
+
+					process_options(from, buf, transfer)
+
+					self.transfers << transfer
 				end
 			else
 				#puts "[-] file not found!"
@@ -348,14 +356,20 @@ protected
 			#puts "%s %s %s" % [start, fn, mode]
 
 			if (not @shutting_down) and (@output_dir)
-				self.transfers << {
+				transfer = {
 					:type => OpWrite,
 					:from => from,
 					:file => { :name => fn, :data => '' },
 					:block => 0, # WRQ starts at 0
+					:blksize => 512,
+					:timeout => 3,
 					:last_sent => nil,
 					:retries => 0
 				}
+
+				process_options(from, buf, transfer)
+
+				self.transfers << transfer
 			else
 				send_error(from, ErrIllegalOperation)
 			end
@@ -368,11 +382,15 @@ protected
 
 			tr = find_transfer(OpRead, from, block)
 			if not tr
+				# NOTE: some clients, such as pxelinux, send an ack for block 0.
+				# To deal with this, we simply ignore it as we start with block 1.
+				return if block == 0
+
 				# If we didn't find it, send an error.
 				send_error(from, ErrUnknownTransferId)
 			else
 				# acked! send the next block
-				tr[:offset] += 512
+				tr[:offset] += tr[:blksize]
 				next_block(tr)
 
 				# If the transfer is finished, delete it
@@ -417,6 +435,58 @@ protected
 		end
 	end
 
+	def process_options(from, buf, tr)
+		found = 0
+		to_ack = []
+		while buf.length >= 4
+			opt = TFTP::get_string(buf)
+			break if not opt
+			val = TFTP::get_string(buf)
+			break if not val
+
+			found += 1
+
+			# Is it one we support?
+			opt.downcase!
+
+			case opt
+			when "blksize"
+				val = val.to_i
+				if val > 0
+					tr[:blksize] = val
+					to_ack << [ opt, val.to_s ]
+				end
+
+			when "timeout"
+				val = val.to_i
+				if val >= 1 and val <= 255
+					tr[:timeout] = val
+					to_ack << [ opt, val.to_s ]
+				end
+
+			when "tsize"
+				if tr[:type] == OpRead
+					len = tr[:file][:data].length
+				else
+					val = val.to_i
+					len = val
+				end
+				to_ack << [ opt, len.to_s ]
+
+			end
+		end
+
+		return if to_ack.length < 1
+
+		# if we have anything to ack, do it
+		data = [OpOptAck].pack('n')
+		to_ack.each { |el|
+			data << el[0] << "\x00" << el[1] << "\x00"
+		}
+
+		send_packet(from, data)
+	end
+
 end
 
 end

data/lib/rex/socket.rb

@@ -135,11 +135,12 @@ module Socket
 	# Wrapper for Resolv.getaddress that takes special care to see if the
 	# supplied address is already a dotted quad, for instance.  This is
 	# necessary to prevent calls to gethostbyaddr (which occurs on windows).
-	# These calls can be quite slow.
+	# These calls can be quite slow. This also fixes an issue with the
+	# Resolv.getaddress() call being non-functional on Ruby 1.9.1 (Win32).
 	#
 	def self.getaddress(addr)
 		begin
-			dotted_ip?(addr) ? addr : Resolv.getaddress(addr)
+			dotted_ip?(addr) ? addr : self.addr_ntoa( ::Socket.gethostbyname(addr)[3] )
 		rescue ::ArgumentError # Win32 bug
 			nil
 		end
@@ -440,11 +441,12 @@ module Socket
 	#
 	##
 
-	def self.source_address(dest='50.50.50.50')
+	def self.source_address(dest='50.50.50.50', comm = ::Rex::Socket::Comm::Local)
 		begin
 			s = self.create_udp(
 				'PeerHost' => dest,
-				'PeerPort' => 31337
+				'PeerPort' => 31337,
+				'Comm'     => comm
 			)
 			r = s.getsockname[1]
 			s.close

data/lib/rex/socket/ssl_tcp.rb

@@ -125,7 +125,7 @@ begin
 		begin
 			return sslsock.sysread(length)
 		rescue EOFError, ::Errno::EPIPE
-			return nil
+			raise EOFError
 		end
 	end
 

data/lib/rex/text.rb

@@ -235,10 +235,10 @@ module Text
 	# Returns the string with nonprintable hex characters sanitized to ascii. Similiar to to_hex,
 	# but regular ASCII is not translated if count is 1.
 	#
-	def self.to_hex_ascii(str, prefix = "\\x", count = 1)
+	def self.to_hex_ascii(str, prefix = "\\x", count = 1, suffix=nil)
 		raise ::RuntimeError, "unable to chunk into #{count} byte chunks" if ((str.length % count) > 0)
 		return str.unpack('H*')[0].gsub(Regexp.new(".{#{count * 2}}", nil, 'n')) { |s| 
-			(0x20..0x7e) === s.to_i(16) ? s.to_i(16).chr : prefix + s
+			(0x20..0x7e) === s.to_i(16) ? s.to_i(16).chr : prefix + s + suffix.to_s
 		}
 	end
 
@@ -476,6 +476,13 @@ module Text
 		end
 	end
 
+	#
+	# Encode an ASCII string so it's safe for XML. It's a wrapper for to_hex_ascii.
+	#
+	def self.xml_char_encode(str)
+		self.to_hex_ascii(str, "&#x", 1, ";")
+	end
+
 	#
 	# Decode a URI encoded string
 	#
@@ -745,11 +752,14 @@ module Text
 	# supplied number of identifiable characters (slots).  The supplied sets
 	# should not contain any duplicate characters or the logic will fail.
 	#
-	def self.pattern_create(length, sets = [ UpperAlpha, LowerAlpha, Numerals ])
+	def self.pattern_create(length, sets = nil)
 		buf = ''
 		idx = 0
 		offsets = []
 
+		# Make sure there's something in sets even if we were given an explicit nil
+		sets ||= [ UpperAlpha, LowerAlpha, Numerals ]
+
 		sets.length.times { offsets << 0 }
 
 		until buf.length >= length

data/lib/rex/text.rb.ut.rb

@@ -24,10 +24,10 @@ class Rex::Text::UnitTest < Test::Unit::TestCase
 	end
 
     def test_html_encode
-        assert_equal('&#x41', Rex::Text.html_encode('A'), 'html_encode default')
-        assert_equal('&#x41', Rex::Text.html_encode('A','hex'), 'html_encode hex')
-        assert_equal('&#65', Rex::Text.html_encode('A','int'), 'html_encode int')
-        assert_equal('&#0000065', Rex::Text.html_encode('A','int-wide'), 'html_encode int-wide')
+        assert_equal('&#x41;', Rex::Text.html_encode('A'), 'html_encode default')
+        assert_equal('&#x41;', Rex::Text.html_encode('A','hex'), 'html_encode hex')
+        assert_equal('&#65;', Rex::Text.html_encode('A','int'), 'html_encode int')
+        assert_equal('&#0000065;', Rex::Text.html_encode('A','int-wide'), 'html_encode int-wide')
 
         assert_raises(TypeError) {
             Rex::Text.html_encode('a', 'umpa lumpa')
@@ -158,6 +158,11 @@ class Rex::Text::UnitTest < Test::Unit::TestCase
 		assert_equal("\\x05Hello\\x06World!\\x03ABC", Rex::Text.to_hex_ascii(str))
 	end
 
+	def test_xml_char_encode
+		str = "\x05hello\x06world"
+		assert_equal("&#x05;hello&#x06;world", Rex::Text.xml_char_encode(str))
+	end
+
 	def test_wordwrap
 		txt = "this is a test of the word wrap features"